Re: [Emc-developers] Critical PHP Vulnerabilities (CVE-2026-109618 and CVE-2026-109619

[John T. <jt...@gn...>]

AFAIK only Jeff knew how to upgrade the forum. I've never attempted to 
do that and Jeff didn't leave me any instructions on how to do that. I 
looked into doing that but couldn't find any "clear" instructions on how 
to upgrade.

I know that Stephen Diercouff "sdg" on the forum and "roycroft" on the 
IRC has made at least one attempt to do an off site upgrade but ran into 
some kind of problem. I added Stephen to this email if the email I have 
is current for him.

I know upgrading the forum involves creating a "droplet" what ever that 
is and installing a new up to date OS, installing Joomula and installing 
Kunena then somehow copying the database from the old to the new.

The only other person I know of that might know how is Alex Joni, he 
created the forum.

JT

On 10/22/26 04:35, andy pugh wrote:
> The forum runs Joomla and Kunena, which are PHP apps, so very much affected.
>
> Digital Ocean report that:
>
> "patches are only available for currently supported PHP versions (8.2
> and later). If you are running an end-of-life PHP version (8.1 or
> earlier), no official patch will be available and you should plan an
> immediate upgrade to a supported version."
>
> Looking at the forum admin panel:
>
> "We have detected that your server is using PHP 7.4.3-4ubuntu2.29
> which is obsolete and no longer receives official security updates by
> its developers. Furthermore, we cannot recommend a newer PHP version
> because you are using an outdated Joomla! version. We recommend
> updating Joomla! and then following further PHP upgrade instructions."
>
> It looks like we need to make a major upgrade.
>
> Do any of us know _how_ to upgrade the forum server? I think that JT might?
>